MV-S501088-00 MP-6478 MLV-2205 MLV-2209 MP6440 MP-6444 MP-6446 MP-6447 MP-6448 - Datasheet Archive

 

PXA3xx (88AP3xx) Processor Family 1. Introduction This document contains updates to the specifications for the PXA3xx (88AP3xx)

 

Specification Update PXA3xx (88AP3xx) Processor Family 1. Introduction This document contains updates to the specifications for the PXA3xx (88AP3xx) Processor Family. This document is a compilation of device and documentation errata, specification clarifications, and specification changes. It is intended for hardware system manufacturers and software developers of applications, operating systems, and tools. Marvell Corporation has endeavored to include all documented errata in the consolidation process. However, Marvell makes no representations or warranties concerning the completeness of the PXA3xx Processor Family Specification Update, Rev. 2.0 Information types defined in Nomenclature are consolidated into the PXA3xx Processor Family Specification Update, Rev. 2.0 and are no longer published in other documents. This document might also contain information that was not previously published. This document contains the following sections: · Section 2. "Affected and Related Documents" · Section 3. "Nomenclature" · Section 4. "Functional Errata Summary" · Section 5. "Detailed Descriptions for Functional Errata" · Section 6. "Specification Clarifications Summary" · Section 7. "Detailed Descriptions for Specification Clarifications" · · · · Section 8. "Specification Changes Summary" Section 9. "Detailed Descriptions for Specification Changes" Section 10. "Documentation Changes Summary" Section 11. "Detailed Descriptions for Documentation Changes" , http://www.marvell.com Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev 2.0B Page 1 Specification Update PXA3xx (88AP3xx) Processor Family 1.1 Document Revision History Table Table 1: Document Revision History Table Doc Rev# Date Devices Covered Description of Changes 2.0 (Release B) 2/06/2009 PXA32x processor, PXA31x processor and PXA30x processor Added Documentation Changes: MP-6478 MP-6478 Removed Documentation Changes: MLV-2205 MLV-2205, MLV-2209 MLV-2209, MP6440 MP6440, MP-6444 MP-6444, MP-6446 MP-6446, MP-6447 MP-6447, MP-6448 MP-6448, MP-6465 MP-6465, MLV2238 MLV2238, MLV-2235 MLV-2235, MLV-2237 MLV-2237, MP-6468 MP-6468, MP-4870 MP-4870, MP-6469 MP-6469, MP6123 MP6123, MP-5875 MP-5875 Added Specification Changes: MP-6480 MP-6480 2.0 (Release A) 1/16/2009 PXA32x processor, PXA31x processor and PXA30x processor Updated Functional Errata: MLV-1902 MLV-1902, ML-1128 ML-1128, MLV-2026 MLV-2026, MP6398 MP6398, MP-6387 MP-6387, MLV-1974 MLV-1974, ML-1114 ML-1114 Added Documentation Changes: MP-6478 MP-6478 Updated Documentation Changes: MLV-2205 MLV-2205, MLV-2209 MLV-2209, MP-6440 MP-6440, MP-6444 MP-6444, MP-6446 MP-6446, MP-6447 MP-6447, MP-6448 MP-6448, MP-6465 MP-6465, MLV-2238 MLV-2238, MLV-2235 MLV-2235, MLV-2237 MLV-2237, MP-6468 MP-6468, MP-4870 MP-4870, MP-6469 MP-6469, MP-6123 MP-6123, MP-5875 MP-5875 PXA32x processor, PXA31x processor and PXA30x processor Updated Functional Errata: MLV-1902 MLV-1902, ML-1128 ML-1128, MLV-2026 MLV-2026, MP6398 MP6398, MP-6387 MP-6387, MLV-1974 MLV-1974, ML-1114 ML-1114 Added Specification Changes: MLV-1273 MLV-1273, MLVM90-13 MLVM90-13, MLV-2077 MLV-2077, MLV-2015 MLV-2015, MLV-1960 MLV-1960, MLV-2240 MLV-2240, MP-6470 MP-6470 Added Documentation Changes: MP-5875 MP-5875 Updated Documentation Changes: MLV-2205 MLV-2205, MLV-2209 MLV-2209, MP-6440 MP-6440, MP-6444 MP-6444, MP-6446 MP-6446, MP-6447 MP-6447, MP-6448 MP-6448, MP-6465 MP-6465, MLV-2238 MLV-2238, MLV-2235 MLV-2235, MLV-2237 MLV-2237, MP-6468 MP-6468, MP-4870 MP-4870, MP-6469 MP-6469, MP-6123 MP-6123, MP-5875 MP-5875 2.0 1.0 (Rev L) 1.0 (Rev K) 1.0 (Rev J) 1.0 (Rev I) 9-30-08 09-12-08 08-08-08 06-18-08 PXA32x processor, PXA31x processor and PXA30x processor Added Specification Changes: MP-6469 MP-6469, MP-6123 MP-6123 PXA32x processor, PXA31x processor and PXA30x processor Added Specification Changes: MP-6468 MP-6468, MP-4870 MP-4870 PXA32x processor, PXA31x processor and PXA30x processor Added Specification Changes: MP-6465 MP-6465, MLV-2235 MLV-2235, MLV-2237 MLV-2237, MLV-2237 MLV-2237 PXA32x processor, PXA31x processor and PXA30x processor Added Specification Changes: MLV-2231 MLV-2231 1.0 (Rev H) 06-03-08 PXA32x processor, PXA31x processor and PXA30x processor Added Functional Errata: MP-6451 MP-6451, MLV-2221 MLV-2221, ML-1187 ML-1187, ML-1180 ML-1180 Updated Specification Changes: Added Specification Changes: 1.0 (Rev G) 5-02-08 PXA32x processor, PXA31x processor and PXA30x processor Added Functional Errata: COMP-518 COMP-518 Updated Specification Changes: MP-6444 MP-6444 Added Specification Changes: MP-6446 MP-6446, MP-6447 MP-6447, MP-6448 MP-6448 1.0 (Rev F) 4-18-08 PXA32x processor, PXA31x processor and PXA30x processor Added Functional Errata: MP-6441 MP-6441 Added Specification Changes: MP-6444 MP-6444 Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 2 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Table 1: Document Revision History Table (Continued) Doc Rev# Date Devices Covered D e s c r i p t io n o f C h a n g e s 1.0 (Rev E) 4-4-08 PXA32x processor, PXA31x processor and PXA30x processor Updated Functional Errata: MLV-1902 MLV-1902, ML-1128 ML-1128 Added Specification Changes: MLV-2209 MLV-2209, MP-6440 MP-6440 1.0 (Rev D) 3-28-08 PXA32x processor, PXA31x processor and PXA30x processor Removed Specification Changes: MP-6438 MP-6438, MP-6435 MP-6435 Added Specification Changes: MLV-2205 MLV-2205 1.0 (Rev C) 3-17-08 PXA32x processor, PXA31x processor and PXA30x processor Added Functional Errata: MLV-2026 MLV-2026, MLV-2166 MLV-2166, MLV-2203 MLV-2203 Added Specification Changes: MP-6438 MP-6438 1.0 (Rev B) 2-29-08 PXA3xx, Vol. I of the combined Developers Manual Added item: "The USB 2.0 Device Controller (U2DC) clock enable bit is missing from the D0CKEN_A register descriptions for CKEN6" in Documentation: 6.6 Changes. 1.0 (Rev A) 2-25-08 PXA32x processor, PXA31x processor and PXA30x processor Initial release of the combined PXA32x processor, PXA31x processor and PXA30x processor. Note The term "device(s)" is used in this functional errata to refer to the PXA320-B0 PXA320-B0, PXA320-B1 PXA320-B1, PXA320-B2 PXA320-B2, and or any combination of the three. Each erratum has a "Relevant for" section, which specifies to which device(s) the erratum applies. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 3 Specification Update PXA3xx (88AP3xx) Processor Family 2. Affected and Related Documents Table 2 lists the documents affected by and related to this errata update. Contact a Marvell representative to obtain the latest revisions of these documents. Table 2: Affected Documents / Related Documents Ti tl e PXA3xx Processor Family Vol. I: System and Timer Configuration Developers Manual PXA3xx Processor Family Vol. II: Memory Controller Configuration Developers Manual PXA3xx Processor Family Vol. III: Graphics and Input Controller Configuration Developers Manual PXA3xx Processor Family Vol. IV: Serial Controller Configuration Developers Manual PXA3xx Processor Family Design Guide PXA3xx Processor Family Processor Electrical, Mechanical, and Thermal Specification (EMTS) PXA3xx Processors Boot ROM Reference Manual Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 4 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 3. Nomenclature Errata are design defects or errors. These errata might cause the PXA3xx (88AP3xx) Processor Family's behavior to deviate from published specifications. Hardware and software designed to be used with any given processor stepping must assume that all errata documented for that stepping are present on all devices unless otherwise noted. Sightings are design defects or errors that the root cause has not yet been determined. These are issues that are being seen during early validation that have not been determined to be real bugs or issues with the testers themselves. Specification changes and clarifications describe a modification to the current published specification or further highlight a specification's impact to a complex design situation. These also include any typos, errors, and omissions from the current published specifications. These will be incorporated in any new release of the document. Errata BTS# is an internal database (Jira) that Marvell uses to track and resolve product issues. It is not customer visible. Internal teams are familiar with the Jira numbers listed in this document. Note Errata in the specification update throughout the product's life cycle, or until a particular stepping is no longer commercially available. Under these circumstances, errata moved from the specification update are archived and made available upon request. Specification changes, specification clarifications, and documentation changes are removed from the specification update when the appropriate changes are made to the appropriate product specification or user documentation (data sheets, manuals, and so forth). Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 5 Specification Update PXA3xx (88AP3xx) Processor Family 4. Functional Errata Summary The following tables summarize the errata, specification changes, specification clarifications, and documentation changes that apply to the PXA3xx (88AP3xx) Processor Family. These tables use the following notations: Table 3: Change Notations N o ta ti o n Meaning A0, B0, etc This errata exists in the PXA3xx (88AP3xx) Processor Family stepping indicated and includes specification change or clarification that applies to this stepping Plan Fix This errata will be fixed in a future stepping of the product. Plan Fix Xx An attempt to fix this errata was made in stepping Xx Fixed in Xx This errata has been fixed in the listed stepping. No Fix There are no plans to fix this errata. Eval Marvell is still researching this errata. No Bug This errata has been determined to be a false errata. Check the workaround section to determine if a document clarification was necessary. X This errata exists in the stepping indicated. Specification change or clarification that applies to this stepping - This errata is fixed in the listed stepping, or the specification change does not apply to the listed stepping Shaded This is either new or has been modified from the previous version of the document Functional Errata Summary Table P X A 3 0 x -A 1 . A Table 4: X X - - - - - 5.2 Errata (FEr#2) ROM: Unable to exit S2/D3/C4 to DDR when fused for NAND boot. page 15 X X X - - - - - 5.3 Errata (FEr#3) ROM: First 32 KB of SRAM is locked when the processor exits Low power modes and resets. page 16 X X X - - - - - 5.4 Errata (FEr#4) ROM: The ICCR[DIM] register gets set when coming out of all resets. page 16 X X X X - - X - 5.5 Errata (FEr#5) ROM: First 1 KB of SRAM is locked when the processor exits Low power mode and resets. page 16 - - - X X X X X PXA30x - A1 X PXA31x - B1 page 14 PXA31x - A2 ROM: Boot ROM reconfigures pads on S2/D3/ C4 exit. PXA31x - A1 5.1 Errata (FEr#1) PXA32x - C0 Page PXA32x - B2 E r ra t u m D e s c r i p t i o n PXA32x - B1 E r ra t u m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 6 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) PXA30x-A1.A Table 4: - - X - - - - 5.98 Errata (FEr#98) ROM: Boot ROM clears the OS Timer Count Register 0 (OSCR0) register while handling resets. page 62 - - - - X X - X 5.7 Errata (FEr#7) CORE: L1 cache maintenance operations close to mem ops can overlock the L1 D-cache. page 17 X X X X X X X X 5.8 Errata (FEr#8) CORE: Locking all eight ways in L2 causes the core to hang. page 18 X X X - - - - - 5.9 Errata (FEr#9) CORE: Debug - hold reset cannot be set before reset is asserted. page 18 X X X X X X X X 5.10 Errata (FEr#10) CORE: A rejected request is retried out of order at the core interface. page 19 X X X - - - - - 5.11 Errata (FEr#11) CORE: dbg txrxctl rr bit gets set when it should not. page 19 X X X X X X X X 5.12 Errata (FEr#12) CORE: Aborted PLD sets lock bit. page 20 X X X X X X X X 5.13 Errata (FEr#13) CORE: In Special Debug State, data can return twice to a register for an aborting load. page 22 X X X X X X X X 5.14 Errata (FEr#14) CORE: Possible instruction corruption during page table Read. page 23 X - - - - - - - 5.15 Errata (FEr#15) CORE: Possible Page table corruption during Read. page 25 X - - - - - - - 5.16 Errata (FEr#16) Core: Data Cache Unit (DCU1) hangs in an infinite recirculate loop which results in data not being returned to the register file. page 25 X X X - - - X X 5.17 Errata (FEr#17) Core: Data Cache Unit (DCU2) Hang with Strongly Ordered Memory page 26 X X X - - - - - 5.18 Errata (FEr#18) Core: System hangs occur while changing operating points when two back to back reads from internal SRAM, the Static Memory Controller, the Dynamic Memory Controller, System Bus 1/System Bus 2 or between the system buses occur. page 27 X X - X X - X X 5.94 Errata (FEr#94) CORE: Random system hangs may occur when exiting S0/D0CS/C1 page 60 X X - X X - X X Copyright © 2009 Marvell April 6, 2009 Released PXA30x - A1 - PXA31x - B1 page 17 PXA31x - A2 ROM: The Boot ROM issues a reset after power on reset that can cause boot failures. PXA31x - A1 5.6 Errata (FEr#6) PXA32x - C0 Page PXA32x - B2 E rr a tu m D e s c r ip ti o n PXA32x - B1 E rr a tu m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 7 Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) P X A 3 0 x - A 1 .A Table 4: X X - - - X X 5.20 Errata (FEr#20) PIN CONTROL: Signals can glitch while entering a hardware or GPIO reset page 28 X X X - - - - - 5.21 Errata (FEr#21) PIN CONTROL: Signals can glitch when a BATT_FAULT occurs. page 28 X X X X X X X X 5.22 Errata (FEr#22) CLK: Ring oscillator frequency may go out of spec leading to UART failures. page 29 X X X - - - X X 5.23 Errata (FEr#23) PMU: When leaving S3/D4/C4, command to reset the voltages not sent to PMIC. page 29 X X X X X X X X 5.24 Errata (FEr#24) PMU: When ACCR[PCCE] = 1 the AGENP[RO_ST] (MP-6377 MP-6377) may not reflect the correct status of the 120 MHz right oscillator. page 29 X X X X X X X X 5.25 Errata (FEr#25) APMU: System hangs may occur when three separate operations execute between the Application Subsystem Power Management Unit (APMU), Application Subsystem Clock Control Unit (ACCU) OS Timers (OST), and Intel XScale® core. page 30 X X X X X X X X 5.26 Errata (FEr#26) APMU: Any Writes to the Application Subsystem Interrupt Control/Status Register (AICSR) register clear the interrupt status bits. page 33 X X X X X X X X 5.27 Errata (FEr#27) SERVICES: GPIO reset wakes up the processor from S3/D4/C4. page 33 X X X X X X X X 5.28 Errata (FEr#28) SERVICES: Unexpected PWR_I2C commands sent on ACCR write. page 34 X X X X X X X X 5.29 Errata (FEr#29) SERVICES: Two sets of PWR I2C sent on S2 exit. page 34 X X X X X X X X 5.30 Errata (FEr#30) SERVICES: 13 MHz stability counter too small (similar to start-of-day problem). page 34 X - - - - - - - 5.31 Errata (FEr#31) SERVICES: nRESET_IN ignored during startof-day VCC_BBATT supply ramp. page 35 X X X X X X X X 5.32 Errata (FEr#32) SERVICES: BATT_FAULT status bit not set between SYS_EN and PWR_EN on a hardware reset. page 35 X - - - - - - - PXA30x - A1 X PXA31x - B1 page 28 PXA31x - A2 PIN CONTROL: Glitches can occur when entering low power mode (S0/D1/C2, S0/D2/C2 and S2/D3/C4) PXA31x - A1 5.19 Errata (FEr#19) PXA32x - C0 Page PXA32x - B2 E r ra t u m D e s c r i p t i o n PXA32x - B1 E r ra t u m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 8 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) PXA30x-A1.A Table 4: X X - - - - - 5.34 Errata (FEr#34) SERVICES: Lockup occurs if nBATT_FAULT asserted after sys_Del count is done and the battery does not have enough energy to complete Start-of-Day sequence. page 35 X X X - - - - - 5.35 Errata (FEr#35) SERVICES: System hangs may occur when increasing operating points from 208 MHz or 416 MHz, or when using 806 MHz or 416 MHz Idle modes. page 36 X X - X X - X X 5.100 Errata (FEr#100) SERVICES: EXT_WAKEUP wakes up on both rising and falling edges regardless of PWER[WEx[1:0]] settings. page 63 X X X X X X X X 5.36 Errata (FEr#36) 1-WIRE: Reads bad data when Receive-BufferFull status bit is set. page 37 X X X X X X X X 5.37 Errata (FEr#37) 1-WIRE: PD flag not cleared when read (when interrupts are disabled). page 38 X X X X X X X X 5.38 Errata (FEr#38) INTERRUPT CONTROLLER: Unexpected exception vector when ICCR[DIM]=0 and ICMR=0. page 38 X X X X X X X X 5.39 Errata (FEr#39) RTC: Wristwatch alarm does not interrupt at the correct time of day page 39 X X X X X X X X 5.40 Errata (FEr#40) OST: Extra count after match when the Match Control registers are set. page 39 X X X X X X X X 5.99 Errata (FEr#99) OS Timer interrupts 4 ­ 11 are missed when an OS Timer Status Register (OSSR) Write occurs at the same time as a match-event interrupt occurs. page 62 X X X X X X X X 5.41 Errata (FEr#41) DMC: Writes to uninitialized memory can hang the system. page 39 X X X X X X X X 5.42 Errata (FEr#42) DMC: DDR not always functional after S2/D3/ C4 exit with Early Start (use ring oscillator) enabled, or when entering/exiting S2/D3/C4 while in S0/D0CS/C0 page 40 X - - - - - - - 5.43 Errata (FEr#43) DMC: DDR Write transactions hanging at 104 MHz due to switch not completing transaction. page 44 X - - - - - - - Copyright © 2009 Marvell April 6, 2009 Released PXA30x - A1 X PXA31x - B1 page 35 PXA31x - A2 SERVICES: SRAM is not retained during a GPIO RESET, and the Boot ROM resumes to SRAM in Non-debug mode. PXA31x - A1 5.33 Errata (FEr#33) PXA32x - C0 Page PXA32x - B2 E rr a tu m D e s c r ip ti o n PXA32x - B1 E rr a tu m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 9 Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) P X A 3 0 x - A 1 .A Table 4: - - - - - X - 5.45 Errata (FEr#45) SMC: When using DMA and the ALT bit in the Address Configuration Registers (CSADRCFGx) is set to 0b00 or 0b01 corruption occurs on the bus. page 44 X X X - - - - - 5.46 Errata (FEr#46) SMC: Last LUA of PCMCIA transaction always has the ALW bit in the Address Configuration Registers (CSADRCFGx) set to 1. page 45 X X X - - - - - 5.47 Errata (FEr#47) SMC: If MECR[CIT] is 0, a Read/Write to the PC card memory space hangs. page 45 X X X - - - - - 5.48 Errata (FEr#48) NFC: Incorrect interrupts reported when running in DMA mode. page 45 X - - - - - - - 5.49 Errata (FEr#49) NFC: Sequential row Reads do not read data correctly with 16-bit NAND. page 46 - - - - - - X X 5.50 Errata (FEr#50) NFC: NAND timing sensitivity on the clocks feeding the NFC registers. page 46 - - - X X X X X 5.51 Errata (FEr#51) NFC: NAND Read data corruption at lower product points (104 MHz and 208 MHz). page 47 - - - X - - - - 5.52 Errata (FEr#52) MMC/SD/SDIO: CS de-assertion/re-assertion timing. page 47 X X X X X X X X 5.53 Errata (FEr#53) MMC/SD/SDIO: MMC does not detect CRC errors or missing stop bit. page 47 X X X X X X X X 5.54 Errata (FEr#54) MMC: MMC_CLK glitch in S0/D0CS/C0. page 48 - X X - - - - - 5.55 Errata (FEr#55) LCD: Data not correct from Overlay 2 in YCbCr 4:2:0 mode. page 48 X X X X X X X X 5.56 Errata (FEr#56) LCD artifacts occur when exiting S0/D1/C2. page 48 - - - X X X X X 5.57 Errata (FEr#57) LCD: VGA screens not supported when using S0/D1/C2 mode. page 49 - - - X X X X X 5.58 Errata (FEr#58) LCD: Insufficient bandwidth to support 640x480 screens when using DDR for the Frame buffer in S0/D0CS/C0 mode. page 49 X X X X - - X X 5.59 Errata (FEr#59) LCD: The MSB acts as both the T-bit and red color when using RGB565 RGB565 with Chroma Keying enabled on Overlay 1 and Overlay 2. page 49 - - - X X X - - PXA30x - A1 - PXA31x - B1 page 44 PXA31x - A2 DMC: DDR failures occur at VCC_APPS 4 counts. page 52 X X X - - - - - 5.70 Errata (FEr#70) TSI: ADCS[RUN] not cleared by TSI state machine page 52 X X X - - - - - 5.71 Errata (FEr#71) TSI: Stylus-up interrupt not reliably generated when XY=1, CC=0, also generating extra Stylus down/up interrupts in continuous conversion (XY=1, CC=1). page 52 X X X - - - - - 5.72 Errata (FEr#72) UDC: FIFO content of an IN endpoint not flushed by FEF when double-buffered page 54 X X X - - - X X 5.73 Errata (FEr#73) U2DC: Corrupted EOP in Full-speed mode causes the U2D to hang. page 54 X X X - - - X X Copyright © 2009 Marvell April 6, 2009 Released PXA30x - A1 - PXA31x - B1 page 61 PXA31x - A2 LCD: VGA Input and Output FIFO under-runs can occur while running in S0/D0CS/C0. PXA31x - A1 5.95 Errata (FEr#95) PXA32x - C0 Page PXA32x - B2 E rr a tu m D e s c r ip ti o n PXA32x - B1 E rr a tu m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 11 Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) P X A 3 0 x - A 1 .A Table 4: X X - - - X X 5.75 Errata (FEr#75) U2DC: DMA not writing data correctly to FIFO when source address is not 8-byte aligned. page 54 X - - - - - - - 5.76 Errata (FEr#76) U2DC: Stopping DMA when SP interrupt occurs causes DMA status error. page 55 X - - - - - - - 5.77 Errata (FEr#77) U2DC: Internal USB host/client resistors may be out of spec above 40 degrees C. page 55 X X X - - - - - 5.78 Errata (FEr#78) U2DC: IN endpoint sends incorrect data and causes a NAK on OUT transfers, if the DMA is started for the next transfer before the FIFO is empty. page 55 X - - - - - - - 5.79 Errata (FEr#79) U2DC: Endpoints with default alternate setting in non-zero interface send STALL after SET CONFIGURATION. page 55 X - - - - - - - 5.80 Errata (FEr#80) U2DC: Signals between U2D and the system bus can be missed at a bus clock frequency of 104 MHz. page 56 X - - - - - - - 5.81 Errata (FEr#81) U2DC: Stall on PING token packets (bulk out or EP0 out) may have incorrect response. page 56 X - - - - - - - 5.82 Errata (FEr#82) U2DC: Setting FST does not STALL an endpoint not affected by an active SET_INTERFACE page 56 X - - - - - - - 5.83 Errata (FEr#83) U2DC: STALL response when an incoming host request collides with an Endpoint FIFO flush. page 57 X - - - - - - - 5.84 Errata (FEr#84) ULPI_STP asserts upon exiting S0/D1/C2 and S0/D2/C2 modes. page 57 - - - X - - - - 5.85 Errata (FEr#85) USBH: USB host Port 3 in Transceiverless mode may not work correctly with an external device. page 58 X X X - - - X X 5.86 Errata (FEr#86) USBH: USB host fails with system bus = 104 MHz or 208 MHz. page 58 - - - - - - X X 5.87 Errata (FEr#87) SSP: EOR is not set when FIFO Packed mode is used. page 58 X X X X X X X X PXA30x - A1 X PXA31x - B1 page 54 PXA31x - A2 U2DC: DMA Control/Status register reports "end of Receive" interrupt on "IN" endpoints PXA31x - A1 5.74 Errata (FEr#74) PXA32x - C0 Page PXA32x - B2 E r ra t u m D e s c r i p t i o n PXA32x - B1 E r ra t u m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 12 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Functional Errata Summary Table (Continued) PXA30x-A1.A Table 4: X X - - - - - 5.89 Errata (FEr#89) UART: When DLL and DLH are programmed at the same time, UART takes in only the first one. page 59 X X X X X X X X 5.90 Errata (FEr#90) UART: TX interrupt can be missed when running full duplex page 59 X X X - - - X X 5.91 Errata (FEr#91) CIR: Wrong symbols sent on second transmission after boot. page 60 X X X X X X X X 5.92 Errata (FEr#92) I2C: Bus Busy bit only changes on state transitions. page 60 X X X X X X X X 5.93 Errata (FEr#93) I2C: Enabling I2C unit drives SCL low. page 60 X X X - - - - - 5.97 Errata (FEr#97) The I2C Unit Not Busy bit (ISR[UB]) remains set after Master Abort page 62 X X X X X X X X Copyright © 2009 Marvell April 6, 2009 Released PXA30x - A1 X PXA31x - B1 page 59 PXA31x - A2 SSP: SSP not functional when entering and exiting S0/D0CS/C0 prior to enabling SSP. PXA31x - A1 5.88 Errata (FEr#88) PXA32x - C0 Page PXA32x - B2 E rr a tu m D e s c r ip ti o n PXA32x - B1 E rr a tu m Number Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 13 Specification Update PXA3xx (88AP3xx) Processor Family 5. Detailed Descriptions for Functional Errata Refer to Section Table 4: "Functional Errata Summary Table" on page 6 to determine which errata are new to this report. 5.1 Errata (FEr#1) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-5737 MP-5737 Description: ROM: Boot ROM reconfigures pads on S2/D3/C4 exit. Problem: The Boot ROM reconfigures MFPRs on S2/D3/C4 exit. These registers should not be modified by the Boot ROM. Implication: For a Resume on a non-trusted NAND platform, the Resume address is taken from the PSPR register and Resume transfers to ISRAM and no MFPR pads are set. Refer to Table 5 for Multi-Function Pin Register (MFPR) Boot ROM configurations. Table 5: Multi-Function Register Pin (MFPR) Settings Ball Name A d d re s s Va l u e GPIO2 0x40E1_012C 0x0000_0001 GPIO3 0x40E1_0134 0x0000_0001 GPIO4 0x40E1_0134 0x0000_0001 nXCVREN 0x40E1_0138 0x0000_1900 nBE0 0x40E1_0214 0x0000_1800 nBE1 0x40E1_0218 0x0000_1800 nLUA 0x40E1_0234 0x0000_1900 nLLA 0x40E1_0238 0x0000_1900 DF_ADDR0 0x40E1_023C 0x0000_1800 DF_ADDR1 0x40E1_0240 0x0000_1800 DF_ADDR2 0x40E1_0244 0x0000_1800 DF_ADDR3 0x40E1_0248 0x0000_1800 DF_CLE 0x40E1_0204 0x0000_1800 DF_ALE_NWE1 0x40E1_0208 0x0000_1801 DF_IO0 0x40E1_024C 0x0000_1401 DF_IO1 0x40E1_0254 0x0000_1401 DF_IO2 0x40E1_025C 0x0000_1401 DF_IO3 0x40E1_0264 0x0000_1401 DF_IO4 0x40E1_026C 0x0000_1401 DF_IO5 0x40E1_0274 0x0000_1401 Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 14 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Multi-Function Register Pin (MFPR) Settings (Continued) Table 5: Ball Name Address Va l u e DF_IO6 0x40E1_027C 0x0000_1401 DF_IO7 0x40E1_0284 0x0000_1401 DF_IO8 0x40E1_0250 0x0000_1401 DF_IO9 0x40E1_0258 0x0000_1401 DF_IO10 0x40E1_0260 0x0000_1401 DF_IO11 0x40E1_0268 0x0000_1401 DF_IO12 0x40E1_0270 0x0000_1401 DF_IO13 0x40E1_0278 0x0000_1401 DF_IO14 0x40E1_0280 0x0000_1401 DF_IO15 0x40E1_0288 0x0000_1401 Workaround: The MFPRs must be reconfigured by software after S2/D3/C4 exit. 5.2 Errata (FEr#2) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-5942 MP-5942 Description: ROM: Unable to exit S2/D3/C4 to DDR when fused for NAND boot. Problem: When fused for NAND boot, it is not possible to exit S2/D3/C4 and boot to DDR. Implication: Cannot directly go from S2/D3/C4 to DDR execution. Workaround: The Boot ROM does not currently support direct exit from S2/D3/C4 to DDR. The first bank of SRAM must be kept on while in S2/D3/C4. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 15 Specification Update PXA3xx (88AP3xx) Processor Family 5.3 Errata (FEr#3) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: ML-989 ML-989 Description: ROM: First 32 KB of SRAM is locked when the processor exits Low power modes and resets. Problem: In non-trusted boot, the Wireless Trusted Module (WTM) locks the first 32 KB of internal SRAM. Implication: Software requiring access to this 32 KB of SRAM is unable to do so. Workaround: None 5.4 Errata (FEr#4) Type: Functional Errata Relevant for: PXA32x - All, PXA31x - A1 Fixed in: PXA32x - No Fix, PXA31x - A2 Errata BTS#: MLV-1762 MLV-1762 Description: ROM: The ICCR[DIM] register gets set when coming out of all resets. Problem: Coming out of all resets, the Boot ROM sets the ICCR[DIM] register. Implication: By setting the ICCR[DIM] register only active, unmasked interrupts as defined in the ICMR register bring the processor out of S0/D0/C1 modes. This bit is ignored in the S0/D0/C0 run mode. Workaround: Software must clear this register after a reset to detect wakeups from the sources defined in the ICPR registers when running in S0/D0/C1 mode. 5.5 Errata (FEr#5) Type: Functional Errata Relevant for: PXA30x-All, PXA31x-All Fixed in: No Fix Errata BTS#: ML-989 ML-989 Description: ROM: First 1 KB of SRAM is locked when the processor exits Low power mode and resets. Problem: In Non-Trusted boot, the Wireless Trusted Module (WTM) locks the first 1 KB of internal SRAM. Implication: Software requiring access to this 1 KB of SRAM is unable to access it. Workaround: Software Workaround Coming out of hardware/GPIO/watchdog reset or S3/D4/C4 mode: 1. Set the CTMCR[0] (0x4300_0010) bit after BOOTROM hands control to OBM. 2. Disable the WTM clock by clearing D0CKEN_A[CKEN[19]] register. Going into S2/D3/C4: 1. Enable WTM clock by setting the D0CKEN_A[CKEN[19]] register. 2. Enable Mini-LCD clocks by setting DOCKEN_B[CKEN[17]] register if it is not enabled. Coming out of S2/D3/C4: 1. D0CKEN_A[CKEN[19]] and D0CKEN_B[CKEN[17]] can be disabled to save power. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 16 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 5.6 Errata (FEr#6) Type: Functional Errata Relevant for: PXA31x-A1 Fixed in: PXA31x-A2 Errata BTS#: ML-1069 ML-1069, MLV-1818 MLV-1818 Description: ROM: The Boot ROM issues a reset after power on reset that can cause boot failures. Problem: After a hardware reset, the Boot ROM issues a reset command (0xFF) to the NAND device. When the Boot ROM issues the next command (Read ID), it is ignored by the NAND device if the NAND device is still in a busy state from the reset command. Implication: Devices that require a Reset command during power transitions and the time the device is busy (Ready/ Busy# transitioning from low to high) after this command is larger than 12 µs fail to boot. Workaround: Ensure the NAND device does not have a power transition requirement that exceeds 12 µs after the reset command is issued. 5.7 Errata (FEr#7) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x-All Fixed in: No Fix Errata BTS#: Core ARS 3584 Description: CORE: L1 cache maintenance operations close to mem ops can overlock the L1 D-cache. Problem: Results in locations being locked into the L1 data cache incorrectly. Memory operations when the L1 data cache is set up for locking (Bit 0 of the L1 Data Cache Lock register is set) can set the lock bit for a different line as well as the preferred line, within the same set. This occurs when the memory operation stalls in the data-cache pipeline due to a L1 cache maintenance instruction preceding the memory operation. This bug is similar to errata #3544. This affects locking into the L1 data cache only. Locking the L1 instruction cache or the L2 cache are not affected. This bug can occur only during the process of locking data into the L1 data cache. Once the data cache has been locked down, the bug has no impact. Steps that expose the bug: 1. Enable DCU locking 2. Perform an L1 cache maintenance operation (defined in subsequent paragraphs) 3. Perform a memory operation followed immediately by a cache-maintenance operation. This sequence is stalled in the third data-cache stage of the pipe by the cache-maintenance operation. A full list of affected L1 cache maintenance commands follows: mcr p15, 0, Rd, c7, c6, 1 - Invalidate L1 D-cache by MVA mcr p15, 0, Rd, c7, c10, 1 - Clean L1 D-cache by MVA mcr p15, 0, Rd, c7, c10, 2 - Clean L1 D-cache by set/way mcr p15, 0, Rd, c7, c14, 1 - Clean and invalidate L1 D-cache by MVA mcr p15, 0, Rd, c7, c14, 2 - Clean and invalidate L1 D-cache by set/way Implication: A location in the same set of the L1 data cache as the stalled memory operation in Step 3 above may be locked and not available for allocation. Data is not modified or corrupted. Workaround: Two workarounds exist: Workaround #1: Do not perform L1 cache-control commands while in DCU locking mode. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 17 Specification Update PXA3xx (88AP3xx) Processor Family Workaround #2: Possible: Separate L1 cache-control commands by at least a single non-memory operation instruction while in DCU locking mode to avoid the stall condition. 5.8 Errata (FEr#8) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: Core ARS 3251 Description: CORE: Locking all eight ways in L2 causes the core to hang. Problem: The replacement behavior on a miss in the L2 cache on a line where all eight ways have been locked is defined as "architecturally unpredictable." However, the implementation treats "all ways locked" as "no ways locked", and as such, normal replacement schemes (excluding lock behavior) dictate which line gets replaced. A corner case is associated with this condition. Normally, when all ways are locked in the L2, the lock bits would be ignored and find the first way that is "not used and not pend" for selecting a replacement. However, in certain situations, there is no way left that is "not used and not pend". The result is that the default replacement is used, and a way that is marked PEND is replaced erroneously. Implication: Locking all eight ways in L2 causes the core to hang. Workaround: Do not lock all eight ways. 5.9 Errata (FEr#9) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: Core ARS 3401 Description: CORE: Debug - hold reset cannot be set before reset is asserted. Problem: The hold_reset bit (accessed through JTAG in DCSR data reg) is what the debugger uses to hold the core in reset while the debugger downloads the debug handler into the SRAM. Typically, a user would set this bit during reset assertion to the chip (and core). Prior to the PXA3xx (88AP3xx) Processor Family core, the debugger could also set this bit even when the core was not in reset, but it would not have any effect until the next core reset. The core would stay in reset until the debugger cleared the keep_reset bit. On the PXA3xx (88AP3xx) Processor Family core, setting this bit prior to reset results in unpredictable behavior when the core comes out of reset. The problem is that while this bit is set, some internal core states are not reset. So, setting this bit during reset (specifically, after the core enters reset) works because there is a point when the core is in reset, but keep_reset has yet to be set by the debugger. Setting this bit prior to reset means when the reset occurs, there is no time at which reset is asserted without keep_reset also being asserted. So this latter case results in some core states not being reset. After reset, this process results in unpredictable operation of the core. This feature is not commonly used, and with the addition of hot-debug hardware to the core, the new hot-debug capabilities provide an alternative solution. Also, since vendors will be using the new hot-debug features (regardless of this keep_reset issue), there is no significant impact on the tools. Implication: PXA3xx (88AP3xx) Processor Family core debug features are not compatible with the PXA27x core. Workaround: The debugger must set the keep_reset bit only after the core has already entered reset. Setting this bit while the core is not already in reset results in unpredictable core behavior. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 18 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 5.10 Errata (FEr#10) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: Core ARS 3501 Description: CORE: A rejected request is retried out of order at the core interface. Problem: If all the conditions below occur, the L1 data cache clean command may proceed when there are no available buffers. Whether it hits or misses, it corrupts a buffer, which can lead to unpredictable behavior. Steps that expose the bug: 1.The following code sequence (back to back, with no intervening instructions): a) Any memory operation (Load, Store, Cache Management operation, etc.) b) L2 cache control command (Clean, Invalidate, etc.) c) L1 data cache clean command (by MVA or by set/way) 2.The Memory buffers are full (heavy recent load/store traffic). 3.Two memory transactions complete within 1-2 cycles freeing up their buffers. This situation can occur even if all pages are marked as writethrough. The Clean command does not have to hit the cache or hit dirty data for the bug to occur. Implication: Possible symptoms: · Dropped memory transaction (load or store) · Part hangs · Incorrect data stored out · Incorrect data returned to a register Workaround: Separate L1 and L2 cache control commands by at least a single non-cache control instruction. 5.11 Errata (FEr#11) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: Core ARS 3551 Description: CORE: dbg txrxctl rr bit gets set when it should not. Problem: This bug occurs when the RX register has a new valid value loaded into it and the rx_valid bit is then polled by the external debugger to determine if the core has read the value. There is a window (approximately six TCK cycles) between the update-DR in the JTAG polling loop of the rx_valid bit and the reading of the RX register by the core software. The read of the RX register by the core clears the TXRXCTL[RR] flag but the polling of the rx_valid bit via JTAG in this window can set the TXRXCTL[RR] flag erroneously again. Implication: When software running on the core communicates to an external debugger, the TXRXCTL[RR] flag can be set erroneously even when there has not been a new DBGRX update sent in via JTAG. In other words, the core software can "think" it has received a new RX data value when, in fact, the debugger did not send a new value. Workaround: Two workarounds exist: Workaround #1: Use the debug handler recommended by Marvell. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 19 Specification Update PXA3xx (88AP3xx) Processor Family Workaround #2: A software workaround for custom debug-handler software is as follows: ­Modify the core software so that after the core reads the RX register, it transmits an "acknowledgement" message containing some recognizable data value to the debugger via the DBGTX register signaling that it has read the RX register. ­The debugger should have a corresponding modification so that it does not poll the DBGRX register again (after sending a valid message) until it "sees" the core software acknowledgement message. Once it detects the acknowledgement message, it can either poll DBGRX or send another message. 5.12 Errata (FEr#12) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, LV-all Fixed in: No Fix Errata BTS#: Core ARS 3558 Description: CORE: Aborted PLD sets lock bit. Problem: This issue results in locations being locked in the cache incorrectly. If a PLD instruction that does not have permission to access a given memory region is used during data-cache locking, then the DCU may incorrectly lock a "hole" into the data cache, effectively reducing the data cache size by one line. PLD instructions are defined to NOT abort ­ that is, if they do not have permission to access a line from memory; they are supposed to turn into a NOP: the data cache should not be updated. In this bug, the data cache is updated with a locked invalid line. Steps that expose the bug: 1. Enable L1 data-cache locking. 2. Perform a PLD instruction that does not have permission. Implication: This process affects locking into the L1 data cache only. Locking the L1 instruction cache or the L2 cache are not affected. This bug can occur only during the process of locking data into the L1 data cache. Once the data cache has been locked down, the bug has no impact. Data aborts taken while the lock bit is set are dangerous because memory operations executed in the abort handler will be locked. Workaround: Use the L1 locking routine specified below or in the PXA3xx (88AP3xx) Processor Family Software Developers Guide: @ Restrictions: @ @ Prefetch abort handler MUST turn off lock mode bit @ as soon as possible. @ @ Data abort handler MUST turn off lock mode bit as @ soon as possible. @ @ If there are any imprecise aborts during locking @ the result of locking is unpredictable. @ Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 20 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family @ PSR bit defines .setPSR_I, 0x80 .setPSR_F, 0x40 @ LockDCache flags .setL_LEN, 0x01 .setL_INV, 0x02 @ Data Cache Lock Mode .setM_LOCKED, 0x01 .setM_NOT_LOCKED, 0x00 @ Cache Line Size .setLINE_SIZE, 0x20 @ @ _LockDCache(Start,End_or_Length,Flags) @ @ Inputs @ R0 Start Address @ R1 End Address (inclusive) or Length @ R2 Flags @ @ Outputs @ R0 Success (1) / Failure (0) @ @ Registers used @ R1 - R3, IP @ @ Usage: @ @ If a region length is specified in R1 then the @ L_LEN flag must be set. All data cache will be @ unlocked and invalidated if the L_INV flag is set. @ If several things are to be locked into the cache @ the L_INV flag should be set for the first item @ to be locked and clear for subsequent items. @ .align 2 .global _LockDCache .type _LockDCache,function _LockDCache: mrs ip, cpsr @ Save CPSR orr r3, ip, #PSR_I | PSR_F msr cpsr_c, r3 @ Disable Interrupts mrc p15, 0, r3, 1, 0, 0 mcr p15, 0, r3, 1, 0, 0 @ Force a DCU drain tst r2, #L_INV Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 21 Specification Update PXA3xx (88AP3xx) Processor Family mcrne p15, 0, r0, c9, c6, 1 @ Unlock D-Cache mcrne p15, 0, r0, c7, c6, 0 @ Invalidate D-Cache mov r3, #M_LOCKED mcr p15, 0, r3, c9, c6, 0 @ Set Lock Mode tst r2, #L_LEN addne r1, r1, r0 cmpne r1, r0 subne r1, r1, #1 CacheFill: @ Uncomment the DCU drain code for REV A0 silicon ldr r2, [r0], #LINE_SIZE @ mrc p15, 0, r3, 1, 0, 0 @ mcr p15, 0, r3, 1, 0, 0 @ Force a DCU drain cmp r0, r1 ldrls r3, [r0], #LINE_SIZE @ mrcls p15, 0, r3, 1, 0, 0 @ mcrls p15, 0, r3, 1, 0, 0 @ Force a DCU drain cmpls r0, r1 bls CacheFill orr r2, r2, r3 @ Create a dependency stall mrc p15, 0, r0, c9, c6, 0 @ Read Lock Mode mov r2, #M_NOT_LOCKED mcr p15, 0, r2, c9, c6, 0 @ Clear Lock Mode msr cpsr_f, ip @ Reset Interrupt flags and r0, r0, #M_LOCKED @ Test lock flag mov pc, lr .Lfe1: .size _LockDCache,.Lfe1-_LockDCache 5.13 Errata (FEr#13) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: Core ARS 3497 Description: CORE: In Special Debug State, data can return twice to a register for an aborting load. Problem: This situation results in the DCU returning twice to a register for an aborting load in SDS (Special Debug State). In SDS, memory operations that would normally abort and cause an event flush do not. Instead, they are supposed to cease operation; specifically, clear the scoreboard bit, and set the "sticky" abort bit in the DCSR. For certain aborting loads, the DCU detects that the load is programmed to abort and clear the scoreboard bit, but also sends out a memory request for the aborting load ­ additionally, the DCU then returns the incorrect data to the register file. Steps that expose the bug: 1. An outstanding store in one of the DCU memory buffers has not been globally observed. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 22 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 2. A strongly ordered operation is executed (either a load or a store). 3. Before the strongly ordered operation in (2) has been globally observed, a Load operation that aborts is executed. Because of (1) and (2), the DCU incorrectly returns twice to the register file. Implication: Special Debug State does not operate correctly. Workaround: A software workaround is appropriate since this bug occurs only during SDS. Two workarounds exist: Workaround #1: Before executing any load that "could" data abort, perform a DCU DRAIN_WRITEBUFFER (dwb) command (defined below). Workaround #2: Because any load in SDS may abort and return incorrect data to a register, check the "sticky" abort bit in the DCSR before using the data from the load in question. This bug does not occur if a DCU_DRAIN (defined below) command is executed before any of the data from the loads is used. Additionally, performing a DCU_DRAIN command before reading the "sticky" abort bit in the DCSR has the added benefit that any imprecise data aborts on the loads have set the abort bit before the data is used. 1. Perform any number of Loads/Stores. 2. Perform the following before the data from the Loads is used: a) DCU_DRAIN b) Read the "sticky" abort bit and verify that no aborts have occurred c) Use the data from the Loads DCU_DRAIN is defined as: mrc p15, 0, r3, c1, c0, 0 @# read CP15 Control register mcr p15, 0, r3, c1, c0, 0 @# write CP15 Control register [the mcr stalls until the L1 D cache buffers have completely drained] DCU_DRAIN_WRITEBUFFER is defined as: mcr 5.14 p15, 0, r0, c7, c10, 4 @# drain write buffer (dwb) Errata (FEr#14) Type: Functional Errata Relevant for: PXA32x - B1 Fixed in: PXA32x - B2 Errata BTS#: MP-5940 MP-5940 (IFU1) Description: CORE: Possible instruction corruption during page table Read. Problem: A different XScale® product has found a core bug that, in extreme conditions, can cause the Instruction Fetch unit to attempt to execute a page table entry as an instruction. Executing a page table as an instruction causes an abort or program hang. Implication: This issue has not been seen on PXA32x processor silicon. It has been reproduced in simulation by locking all but one of the TLB entries, and using VLIO code execution (not a normally supported mode) to adjust the timings necessary to aggravate this problem: 1. All but 1 TLB entries are locked, leaving only one TLB entry available. The bug can occur with no TLB entries locked, but is much less likely to occur. 2. A prefetch to line A in descriptor page 1 occurs. 3. Branch to line C in descriptor page 2. This can be a Direct branch or interrupt. During the branch, the TLB entry for line A is replaced with line C. 4. Branch back to Line A, while the prefetch for cache Line A is still waiting for instruction data. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 23 Specification Update PXA3xx (88AP3xx) Processor Family 5. A Page Table Walk for Line A is now required, because the TLB for Page 1 was replaced. 6. When the prefetched data for Line A returns, the Descriptor data for Line A is also returning. 7. As the Table Walk completes, the Fill buffer read for the Table Walk corrupts the Instruction Read. 8. The core executes the Page Table as an instruction. This issue does not affect the data TLB. Workaround: Use a Performance Monitoring Unit interrupt to limit the instruction TLB usage: 1. Assign the PMU interrupt to FIQ. Only this interrupt can be assigned to the FIQ. 2. Set a watermark of TLB misses before an interrupt occurs based on watermark = 32 - (number of locked TLB entries) - 2. 3. Do not lock more than 28 TLB entries. 4. Invalidate by TLB entry is not allowed. 5. All PMU interrupts (if others are used) must invalidate the TLB and reset the PMU counter. 6. The TLB invalidation and PMU counter reset must occur first in the FIQ. 7. The FIQ must never be masked. 8. The TLB must be invalidated before a series of TLB locks. If multiple entries need to be locked, the locks must be executed from the same page and be guaranteed to not cause a Table Walk (do not place Lock code at the end of the page). 9. If code is copied into memory using the core, the L2 must be cleaned and invalidated. 10. Example setup code: mov r8, #0 mcr p14, 0, r8, c0, c1, 0 mcr mov add add add mcr mov mcr mov sub mcr mov mcr mrs bic msr p14, 0, r8, c4, c1, r8, #0xff000000 r8, r8, #0x00ff0000 r8, r8, #0x0000ff00 r8, r8, #0x00000003 p14, 0, r8, c8, c1, r8, #2 p14, 0, r8, c4, c1, r8, #-1 r8, r8, #24 p14, 0, r8, c0, c2, r8, #1 p14, 0, r8, c0, c1, r8, cpsr r8, r8, #0x40 cpsr_c, r8 @ disable all counters PMNC 0 @ disable all interrupts 0 @ set evtsel0 for itlb miss 0 @ enable pmn0 interrupts 0 @ load pmn0 0 @ enable event counters pmnc @ enable fiq Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 24 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 11. Example FIQ handler: mcr p15, 0, r8, c8, c5, 0 @ invalidate itlb mov sub mcr @ allow Watermark itlb hits @ reload PMNC0 mrc mcr p14, 0, r8, c5, c1, 0 p14, 0, r8, c5, c1, 0 @ clear overflow subs 5.15 r8, #-1 r8, r8, # p14, 0, r8, c0, c2, 0 pc, lr, #4 @ return Errata (FEr#15) Type: Functional Errata Relevant for: PXA32x - B1 Fixed in: PXA32x - B2 Errata BTS#: MP-6011 MP-6011 (IFU2) Description: CORE: Possible Page table corruption during Read. Problem: A Branch/Exception flush reaches the Instruction Fetch unit two clocks before a Page Table walk. A data return from the last phase of a Fetch/Prefetch must return to the Instruction Fetch unit one clock after the Table Walk. This causes the Table Walk to become corrupted with the Fetch/Prefetch data, causing the instruction to be placed into the TLB as a table entry. There is a very small one cycle window during which a Table Fetch, data return, and Branch/Exception flush must all occur at the same time. Implication: The Translation Lookaside buffer entry is corrupted and can cause various problems, including a Page Table fault, incorrect translation (execution continues at an incorrect page), or access permission corruption. Analysis of the trace buffers is required to confirm that this bug is the cause. It has been duplicated in PXA320 PXA320 simulations but not in silicon after extensive testing. Other products using this core have not seen this issue in silicon. Workaround: Disable L2. However, the chance of this bug occurring is very low. 5.16 Errata (FEr#16) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All Fixed in: No Fix Errata BTS#: MP-6244 MP-6244, ML-981 ML-981, MLV-1723 MLV-1723 Description: Core: Data Cache Unit (DCU1) hangs in an infinite recirculate loop which results in data not being returned to the register file. Problem: With the L1 Data Cache cacheable -or- L1 Data Cache uncacheable and the L2 Cache cacheable, a specific sequence of loads and stores to the Data Cache Unit and a specific sequence of data being returned within an extremely narrow timing window can cause the Data Cache Unit to hang in an infinite loop. Required conditions for replicating the issue with and without evictions (All Loads/Stores are to L1 cacheable memory -or- L1 uncacheable and L2 cacheable memory): Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 25 Specification Update PXA3xx (88AP3xx) Processor Family 1. A Load misses the L1 data cache and must cause an eviction of a clean cacheline in the same set. However, this first load is not necessary (which means the L1D eviction is not a necessary condition). 2. A store is being retried by the Data Cache Unit due to a backed up Bus Interface Unit. 3. Four loads to the same cacheline that miss the data cache. 4. The following timing conditions must then happen: ­ Must have some other unrelated instructions with no register dependencies occurring between #3 and #5. 5. A load, which is to the same cacheline as the store in #2, misses the data cache. ­The first Load in #3 gets its data back into the Data Cache Unit exactly one cycle after this load gets executed. ­ The Store in #2 still retries from the Data Cache Unit and one of the attempts happens exactly one cycle after this load gets executed. ­ No dependencies on previous loads. 6. A Load, which is to the same cacheline as the four loads in #3, misses the data cache. ­ No dependencies on previous loads. ­ Must be back-to-back with #5. Implication: 7. A Load operation to any address. ­ Must be back-to-back with #6. If the Data Cache Unit encounters this condition, it enters an infinite loop, resulting in no data being returned and thereby, hanging the processor core. Notes: ­ This issue has been observed only on an SOC not related to the PXA3xx processors while running hand-tuned focus tests written to specifically reproduce this issue. ­The only way to exit this condition is to reset the XScale® core. ­Independent of L1 data cache operating in Writethrough or Writeback mode. ­Independent of whether L2 cache is present. ­Independent of Bus timings/ratios. Workaround: No workaround. However, there is a recovery mechanism in the unlikely event that is does occur. If a lockup does occur, the only way to exit this condition is to reset the processor core. Examining the trace buffer after a reset provides information on the code sequencing (within 16 clock cycles) leading to the lockup. Once identified, code corrections can be made to eliminate the condition as listed in the "Required Conditions" section above that created the lockup. 5.17 Errata (FEr#17) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-6251 MP-6251, ML-983 ML-983, MLV-1726 MLV-1726 Description: Core: Data Cache Unit (DCU2) Hang with Strongly Ordered Memory Problem: With the L1 Data Cache cacheable -or- L1 Data Cache uncacheable and the L2 Cache cacheable, a specific sequence of loads and stores to the Data Cache Unit with a strongly ordered load and a specific sequence of data being returned within an extremely narrow timing window can cause the Data Cache Unit to hang, thereby hanging the processor core. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 26 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Required Conditions (All Loads/Stores are to L1 cacheable memory -or- L1 uncacheable and L2 cacheable memory): 1.A load misses the data cache and must cause an eviction of a dirty cacheline. ­This eviction has to land between #2 and #3. 2.Four loads to the same cacheline that miss the data cache. No dependencies on previous loads. 3.A memory access that is Strongly Ordered within a few instruction cycles of #2. No dependencies on loads in #2. Implication: If the Data Cache Unit encounters this condition, the load to strongly ordered memory is dropped, never returning the data and thereby, hanging the processor core. Notes: ·"This issue has only been observed on the 8134x when running hand-tuned focus tests written to specifically reproduce this issue. ·"The only way to exit this condition is to reset the processor core. ·"Independent of L1 data cache operating in write through or write back mode. ·"Independent of L2 cache being present or not. ·"Independent of Bus timings/ratios. Workaround: Two workarounds exist for this issue. 1.Convert all "Strongly Ordered Memory" operations into "Device Memory" operations inside the Kernel. Where memory is configured as Strongly Ordered (in the page table, the following bits are set TEX=000b and CB=00b) the memory should be changed to be configured as Device Memory (in the page table, the following bits are set (TEX=010b and CB=00b for non-shared device memory) -or(TEX=001b and CB=01 for shared device memory). Small Page Descriptors cannot specify the TEX attribute. In this case, the TEX attribute will default to 0. If CB=00b is used with Small Page Descriptors, a Strongly Ordered Memory region is created. Therefore, do not use Small Page Descriptors; use Extended Small Page Descriptors instead. 2.This is more of a recovery mechanism (not a workaround) in the unlikely event that does occur. If a lockup does occur, the only way to exit this condition is to reset the processor core. Examining the trace buffer after a reset would give information on the code sequencing (within 16 clock cycles) leading to the lockup. Once identified, code corrections can be made to eliminate the condition as listed in the "Required Conditions" section above that created the lockup. 5.18 Errata (FEr#18 ) Type: Functional Erratum Relevant for: PXA32x - B1,B2, PXA31x - A1,A2, PXA30x - All Fixed in: PXA32x - Plan Fix C0, PXA31x - Plan Fix B1, PXA30x - No Fix Errata BTS#: MP-6398 MP-6398 Description: Core: System hangs occur while changing operating points when two back to back reads from internal SRAM, the Static Memory Controller, the Dynamic Memory Controller, System Bus 1/System Bus 2 or between the system buses occur. Problem: Data corruption occurs on the memory switch when back to back reads from internal SRAM, SMC, DMC, System Bus 1/ System Bus 2, or between the two system buses occur while the controller clock or bus frequencies are changing (ACCR[SFLFS], ACCR[SMCFS], ACCR[DMCFS], or ACCR[HSS]). Both reads must be from the same controller or bus, and the corresponding clock must be changed during Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 27 Specification Update PXA3xx (88AP3xx) Processor Family the first read cycle. The second read will be missed by the switch which will cause the switch to stall while waiting for the read data. Implication: The data corruptions will result in system hangs. Workaround: Software must ensure that no more than one read is occurring from these controllers or buses while changing operating points where the ACCR register is programmed to change the controller frequencies. This issue has only been seen during internal testing and has not occurred under a full operating system. 5.19 Errata (FEr#19) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All Fixed in: No Fix Errata BTS#: MP-5887 MP-5887, ML-792 ML-792, MLV-1345 MLV-1345 Description: PIN CONTROL: Glitches can occur when entering low power mode (S0/D1/C2, S0/D2/C2 and S2/D3/ C4) Problem: Because of a race condition within the low-power-mode control muxes, a glitch might occur when entering or exiting low-power modes. Implication: The glitch can occur on any signal that uses the MFPR. Workaround: See below: 1.Set SLEEP_SEL for all signals at the same time that the MFPR is programmed. SLEEP_SEL can be left at 1. 2.Once all signals have been configured, RDH can be released. The boot ROM will clear the SLEEP_SEL bit of any pins it needs when exiting reset, while leaving RDH set. 5.20 Errata (FEr#20) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-5837 MP-5837 Description: PIN CONTROL: Signals can glitch while entering a hardware or GPIO reset Problem: During a reset, the SMC is reset before the pads are disconnected. Implication: During a reset the SMC non-EMPI control signals may glitch, including nCS2, nCS3, and nWE. This can cause problems with external devices that cannot tolerate the glitches. For example, external SRAM or CPLDs. Because flash memory requires a sequence of commands, it is not affected by the glitches. Workaround: Gate problematic signals with nRESET_OUT to prevent glitch propagation. 5.21 Errata (FEr#21) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5911 MP-5911, ML-810 ML-810, MLV-1397 MLV-1397 Description: PIN CONTROL: Signals can glitch when a BATT_FAULT occurs. Problem: During a BATT_FAULT, the APMU gets reset at the same time it is trying to turn off power and disconnect the pads. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 28 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Implication: Any signal could potentially glitch during a BATT_FAULT entry. Workaround: None 5.22 Errata (FEr#22) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All Fixed in: No Fix Errata BTS#: MP-5892 MP-5892, ML-763 ML-763, ML-793 ML-793 Description: CLK: Ring oscillator frequency may go out of spec leading to UART failures. Problem: A frequency stability glitch occurs on the outputs of the ring oscillator clock causing the UART clock to be out of spec on slow and fast corners at cold and hot temperatures when the ring oscillator is recalibrating. Implication: Clock instability in S0/D0CS/C0 causes random UART failures when running at higher baud rates. This instability limits the maximum guaranteed supported UART baud rate in S0/D0CS/C0 to 12 Kbps Workaround: None. Limiting VCC_MVT to 1.85 V reduces the possibility of these failures across temperature changes. 5.23 Errata (FEr#23) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5494 MP-5494, ML-679 ML-679, MLV-1076 MLV-1076 Description: PMU: When leaving S3/D4/C4, command to reset the voltages not sent to PMIC. Problem: When leaving S3/D4/C4, the PWR_I2C does not send out register writes to the PMIC to reconfigure the voltage level. Implication: After exiting S3/D4/C4, there is a slightly higher than normal power consumption since the PMIC is driving the voltages higher than expected. Workaround: After exiting S3/D4/C4, perform a dummy frequency-change sequence to the S3/D4/C4 exit routine. This frequency change must be to the reset state frequency that requires voltage level 0. After this frequency change, perform the frequency change to the targeted frequency/voltage. 5.24 Errata (FEr#24) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No FIx Errata BTS#: MP-5308 MP-5308, ML-616 ML-616, MLV-989 MLV-989 Description: PMU: When ACCR[PCCE] = 1 the AGENP[RO_ST] (MP-6377 MP-6377) may not reflect the correct status of the 120 MHz right oscillator. Problem: When leaving S0/D0CS/C0 mode the ring oscillator does not get disabled, and the two ring oscillator status bits (AGENP[RO_ST] and OSCC[ROS]) may not show the same status settings. Implication: The ring oscillator may be in a different status than expected, and may not become disabled when software sets the AGENP[RO_CTRL] bit. Workaround: 1.After exiting S0/D0CS/C0 mode (ASCR[R0_S] = 0) read OSCC[ROS] and AGPENP[RO_ST] registers 2.If OSCC[ROS] = AGPENP[RO_ST] = 1 · Set the AGENP[R0_CTRL] bit to 1 3.If OSCC[ROS] and AGPENP[RO_ST] are not equal. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 29 Specification Update PXA3xx (88AP3xx) Processor Family · · · 5.25 Set the AGENP[R0_CTRL] bit to 1 Wait until AGENP[R0_CTRL] bit is cleared to 0 Set the AGENP[R0_CTRL] bit to 1 Errata (FEr#25) Type: Functional Errata Relevant for: PXA32x - All, PXA31x - All, PXA30x - All Fixed in: No Fix Errata BTS#: MP-6387 MP-6387, MLV-1974 MLV-1974, ML-1114 ML-1114 Description: APMU: System hangs may occur when three separate operations execute between the Application Subsystem Power Management Unit (APMU), Application Subsystem Clock Control Unit (ACCU) OS Timers (OST), and Intel XScale® core. Problem: Data corruption can occur when two overlapping events within the APMU are closely followed by a read from the Intel XScale® core. The Intel XScale® core reads are reads to any register within the ACCU, APMU, or OST. The events within the APMU can come from any of the following three sources. 1. Intel XScale® core writes to the OS Timer Status Register (OSSR) or Application Subsystem Interrupt Control/Status Register (AICSR) registers 2. OST Match Event occurs and the OSSR register is written to clear the status bit(s) for the corresponding timer while the OS Timer Interrupt is enabled (OS Timer Interrupt Enable Register (OIER). 3. The ACCU writes to the AICSR register in response to a Frequency Change (FCIS), Power Mode Change (PCIS) or a Temperature Induced Frequency Change (TCIS) while the interrupts are enabled (FCIE, PCIE and TCIE) Implication: Data corruption will result in system hangs when the two overlapping writes and the register read occur within the following timing windows. Figure 1 and Figure 2 a diagram showing the series of events that must happen within the APMU for system hangs to occur. · Back to back OST match events occur less than 350 ns apart ­Register read occurs any time between the first interrupt request and the second interrupt request. · OST match event occurs less than 350 ns from a ACCU interrupt request ­Register read occurs any time between the first interrupt request and the second interrupt request. · Write to one of the OSSR/AICSR registers is less than 550 ns from the interrupt request from the OST and a register read occurs during the second interrupt ­May occur when using any number of OST match event interrupts ­Register write may occur during first Interrupt Service Routine before the second OST Match event occurs · Write to one of the OSSR/AICSR registers is less than 550ns from the interrupt request from the ACCU and a register read occurs during the second interrupt. Workaround: ·There are two independent workarounds when using a single OST Match event depending on which timers are being used and how they are being used. ·When using a single OS Timer. 1.The following steps are recommended when using an OS Timer where the counter continues to run after a match event or the counter register is not reset after a match event occurs (OSMRx[R] = 0) · The ACCU frequency change interrupts (AISCR[xCIE]) must be disabled and XScale core writes to the AICSR register to clear status bits are prohibited Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 30 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family · Software must ensure that the XScale core writes to the OSSR register cannot overlap with the OST match event interrupt request. ­Only write the OSSR to clear the Interrupt Status bit in the OST Match Event Interrupt Service routine. · Software must ensure the next Match Event interrupt request is at least 350ns from the previous event. ­Reloading the OSMRx Register for the next Match event based off the current Match register value (OSCR0) is recommended. 2.When using a single OS Timer 4 ­ 11, the following procedures are recommended to ensure that no overlapping APMU events occur from any source when the Periodic Timer stops incrementing after a match is detected (OSMRx[P] = 0) or when the OSCRx register is reset after a match occurs (OSMRx[R] = 1). · The ACCU Frequency Change interrupts (AISCR[xCIE]) must be disabled and XScale core Writes to the AICSR register to clear status bits are prohibited. · Software must ensure that XScale core Writes to the OSSR register cannot overlap with the OST Match events. ­Only write the OSSR to clear the Interrupt Status bit in the OST Match Event Interrupt Service Routine. · When using a multiple OS Timers 3. Marvell recommends using a single Match Event architecture along with the Operating System Scheduler for systems requiring multiple event timers. · The OS Scheduler replaces additional timers with a lightweight thread that creates separate intervals. These intervals are created by the call Sleep(). 4. For systems that must use multiple OS timers, follow these recommended steps to avoid the failure window. · The ACCU Frequency Change interrupts (AISCR[xCIE]) must be disabled and XScale core Writes to the AICSR register to clear status bits are prohibited. · Software must ensure that the XScale core writes to the OSSR register cannot overlap with the OST Match Event interrupt request. ­Only write the OSSR to clear the Interrupt Status bit in the OST Match Event Interrupt Service Routine ·Software must only use OS Timers 4 ­ 11 with a 32KHz Counter resolution. ·OMCRx[CRES] = 0b001, 0b010 and 0b011). ·All other OMCRx[CRES[3:0]] values are not allowed ·Software must ensure that ACCU, APMU or OST register reads are issued outside the failure windows ·Software must ensure the next match event interrupt request is at least 350ns from a previous match event interrupt request. ­Software should enable the Automatic OSCRx Reset (OSMRx[R] = 1) or disable the OSCRx incrementing after reset (OSMRx[P] = 0) ·Using OSCR0 along with OSMR3 to generate watchdog resets allowed. 5.For systems needing to use multiple OST 0 ­ 3 timers the following steps are recommended to avoid the failure window. ·The ACCU frequency change interrupts (AISCR[xCIE]) must be disabled and Xscale core writes to the AICSR register to clear status bits are prohibited. ·Software must not use OS Timers 4 ­ 11. · Software must ensure that the XScale core writes to the OSSR register cannot overlap with the OST Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 31 Specification Update PXA3xx (88AP3xx) Processor Family Match Event writes to the OSSR. ­Only write the OSSR to clear the interrupt status bit in the OST Match Event Interrupt Service Routine · Software must ensure the next Match Event interrupt request is at least 350ns from a previous Match Event interrupt request. · Software must ensure that ACCU, APMU or OST register reads are issued outside the failure windows. The following procedures are recommended to avoid having a read issued during the failure window. ­After write to the OSSR register to clear the interrupt status bits software must issue reads to the Services Power Management Scratch Pad Register (PSPR) before reading any APMU, ACCU, or OST registers. The following instructions are recommended for the OST Interrupt Service Routine for clearing the OST status registers and avoiding having a read fall within the failure window. · Write OSSR ­ clear interrupt pending status bits. · Data Memory Barrier Instruction (DMB) ·Read PSPR · Data Memory Barrier Instruction (DMB) · Read PSPR · Data Memory Barrier Instruction (DMB) · Using OSCR0 along with OSMR3 to generate watchdog resets allowed. Figure 1: Single OS Timer Match Event with an OSSR Write failure window Notes · · · tWRITE: Register write request tINT: duration of interrupt service request (100 ns - 200 ns) tWINDOW: Time between OSSR/AISCR write and the interrupt request. To avoid failure window must be greater than 550 ns. · tREAD: Time which the ACCU/APMU/OST read request must be received Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 32 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Figure 2: Multiple OS Timer Match Event Notes · · · tINT1: duration of first OST ISR. (200ns) tINT2: duration of second OST ISR (100ns) tWINDOW: Time between the back to back interrupt requests. To avoid failure window must be greater than 350ns + tINT1 · tREAD: Time which the ACCU/APMU/OST read request must be received 5.26 Errata (FEr#26) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-6392 MP-6392, MLV-2000 MLV-2000, ML-1117 ML-1117 Description: APMU: Any Writes to the Application Subsystem Interrupt Control/Status Register (AICSR) register clear the interrupt status bits. Problem: The AICSR register is a "write 1 to clear" register but any writes to this register clear all status bits. Implication: Software cannot clear the single status bit which can cause other interrupt bits to be cleared unintentionally. Workaround: Do not use the AICSR register for frequency or Power mode changes. 5.27 Errata (FEr#27) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5014 MP-5014, ML-547 ML-547, MLV-898 MLV-898 Description: SERVICES: GPIO reset wakes up the processor from S3/D4/C4. Problem: If a GPIO reset is detected before services completes an S3/D4/C4 entry, the reset is treated as a wake up. The processor enters S3/D4/C4 but exits right away and the following register status is observed: ARSR[LPMR]=1, AD3SR=0, PWSR=0, PSR[SS3S]=1 Note: S3/D4/C4 entry only occurs through BATT-FAULT. Implication: Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 33 Specification Update PXA3xx (88AP3xx) Processor Family Workaround: Based on the above register bit combinations, it is possible to deduce that the part entered S3/D4/C4 and exited due to a GPIO reset. 5.28 Errata (FEr#28) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-4797 MP-4797 Description: SERVICES: Unexpected PWR_I2C commands sent on ACCR write. Problem: When writing the ACCR but not setting the T- or F-bits, an unexpected PWR_I2C transaction is sent. Implication: When lowering the frequency, the voltage could be lowered without the core actually changing frequency. Workaround: Always set the F-bit after writing new L/N values to ACCR before setting ACCR for other frequency changes. 5.29 Errata (FEr#29) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5502 MP-5502, MLV-1080 MLV-1080 Description: SERVICES: Two sets of PWR I2C sent on S2 exit. Problem: Two sets of PWR I2C commands are sent during S2 exit. Implication: Boot continues after the first set of commands are sent. Code is being fetched during the second set of commands. Workaround: None 5.30 Errata (FEr#30) Type: Functional Errata Relevant for: PXA32x - B1 Fixed in: PXA32x - B2 Errata BTS#: MP-5970 MP-5970 Description: SERVICES: 13 MHz stability counter too small (similar to start-of-day problem). Problem: The 13 MHz crystal stability counter is too small, giving insufficient time for the crystal to stabilize before attempting to continue execution during start-of-day. Implication: Because the 13 MHz crystal is not stabilized, the internal PLLs may miss clocks, causing a failure to lock during startup. Also causes problems with connecting via JTAG, requiring multiple reconnects. Workaround: Remove the 13 MHz crystal and replace it with a 13 MHz external oscillator. Use PWR_EN to control the oscillator power supply, with VCTCXO_EN tied to the Oscillator Enable pin. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 34 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family 5.31 Errata (FEr#31) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5961 MP-5961 Description: SERVICES: nRESET_IN ignored during start-of-day VCC_BBATT supply ramp. Problem: During the start-of-day power supply ramp for VCC_BBATT, the nRESET_IN signal is blocked. Implication: Short resets during start-of-day may be ignored. Workaround: This is a rare case that is not expected to cause customer problems. If resets are possible while VCC_BBATT is ramping, ensure they are held until VCC_BBATT has stabilized. 5.32 Errata (FEr#32) Type: Functional Errata Relevant for: PXA32x - B1 Fixed in: PXA32x - B2 Errata BTS#: MP-6060 MP-6060 Description: SERVICES: BATT_FAULT status bit not set between SYS_EN and PWR_EN on a hardware reset. Problem: During hardware reset, BATT_FAULT is ignored after SYS_EN is high and before PWR_EN goes high. Other times BATT_FAULT is correctly captured. Implication: PSR[batt_fault] is not set, allowing the device to continue booting even though a BATT_FAULT was detected. Even if BATT_FAULT is held low after PWR_EN goes high, it is still ignored. Workaround: None. 5.33 Errata (FEr#33) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-6158 MP-6158 Description: SERVICES: SRAM is not retained during a GPIO RESET, and the Boot ROM resumes to SRAM in Nondebug mode. Problem: In Non-debug mode, the Boot ROM resumes to internal memory after a GPIO reset. However, the SRAM is not retained during a GPIO reset. Implication: System may lock up after a GPIO reset if the SRAM loses state. Workaround: None 5.34 Errata (FEr#34) Type: Functional Errata Relevant for: PXA32x - All Fixed in: No Fix Errata BTS#: MP-6187 MP-6187 Description: SERVICES: Lockup occurs if nBATT_FAULT asserted after sys_Del count is done and the battery does not have enough energy to complete Start-of-Day sequence. Problem: There is a window during the start-of-day sequence, after the sys_del counter is done, if a BATT_FAULT occurs during the window and the power supplies shut down (except for VCC_BBATT), the part locks up. Implication: Once the part locks up, applying power again does not recover the device. Workaround: There are two workarounds for this problem: Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 35 Specification Update PXA3xx (88AP3xx) Processor Family 1. Drain VCC_BBATT after the lockup occurs. For end-customers, this approach may require removing the main battery and waiting for the supercap to drain. For designs using a backup battery, Option #2 is the only workaround. 2. Cause a nRESET assertion after applying main power. This approach would require an nRESET button to be accessible to end-use customers. 5.35 Errata (FEr#35) Type: Functional Errata Relevant for: PXA32x - B1,B2, PXA31x - A1,A2, PXA30x - All Fixed in: PXA32x - Plan Fix C0, PXA31x - Plan Fix B1, PXA30x - No Fix Errata BTS#: MLV-1902 MLV-1902, ML-1128 ML-1128 Description: SERVICES: System hangs may occur when increasing operating points from 208 MHz or 416 MHz, or when using 806 MHz or 416 MHz Idle modes. Problem: Random system lockups may occur when the XScale® core PLL is relocked. The failure is seen more often when performing frequency change stress tests for a varying length of time. This failure is seen in the following states. 1. Increasing frequency from either 208MHz (XL = 16; XN = 1) or 416 MHz (XL=16; XN = 2). 2. Core enters 806 MHz or 416 MHz Idle modes Implication: Systems may intermittently lock up under very specific circumstances. Evaluation of this lockup has determined that the issue has been seen when: ­The operating point being increased to has a Turbo-mode to Run-mode ratio of 2:1 (XN =2). ­ The processor is placed in Idle mode (Write to PMRMODE register) with XL = 16 and XN = 2 (416 MHz run) ­The ACCR[XL] = 16 before the frequency change. ­There is an operation that involves a PLL relock or the PLL divisors are changed · Once a lockup has occurred the system must be reset · The following operating point changes may intermittently cause a lock-up. 1. 208 MHz -> 416 MHz 2. 208 MHz -> 624 MHz 3. 416 MHz -> 624 MHz Workarounds: There are two different workarounds, one for changing frequencies (#1) and one for avoiding 416 MHz Idle lock-ups (#2) Workaround #1: When increasing the operating point (core frequency), software must first switch the core frequency to 104 MHz (XL = 8; XN = 1) before switching to the higher operating point. Changing the ACCR bus frequencies to match the 104 MHz operating point is not required. The following steps must be followed when increasing operating points: 1. Disable voltage-change commands to the PMIC by clearing the PVCR[PVE] and PVCR[FVE]. 2. Set ACCR[XN] = 1, ACCR[XL] = 8 and ASCR[MTS] = 1 for 104 MHz. 3. Set the XCLKCFG[F] and XCLKCFG[T] bits to 1 to initiate the frequency change. 4. Re-enable the voltage-change commands to the PMIC by setting the PVCR[PVE] and PVCR[FVE] bits to 1. 5. Set the ACCR[XN] and ACCR[XL] and ASCR[MTS] for the new operating point. 6. Set the XCLKCFG[F] and XCLKCFG[T] bits to 1 to initiate the frequency change. 7. Set the remaining ACCR register values to configure the correct bus frequencies for the new operating point. Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 36 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family Workaround #2: There are four possible replacements for 806 MHz or 416 MHz idle modes and 1 possible workaround if the system hangs when using 806 MHz or 416 MHz Idle modes: 1. Use a software-based Idle Replacement routine. When there are no tasks to run, use a Whileloop to wait for the next interrupt. · This workaround has the lowest latency, but power savings are minimal. 2. Use 104 MHz IDLE as a replacement for 806 or 416 IDLE. The software flow is: 1. Determine there are no tasks and decide to go to Idle. 2. Switch to 104 MHz Run mode (XL = 8 and XN = 1). 3. Issue a PWRMODE command to place the core into Idle. 4. When an interrupt occurs to return the processor to Run mode, switch to 416 MHz Run mode. Switching to 104 MHz incures a ~30 µs delay going to 104MHz and a 30 µs delay upon resume before code is running at 416MHz. This workaround has better power savings, but higher latency on Resume. 3. Use 208 MHz (XL=16; XN = 1) IDLE as a replacement for 806 MHz (XL=31; XN = 2) or 416 MHz (XL=16; XN =2) IDLE. The software flow is: 1. Determine there are no tasks and decide to go to Idle. 2. Change the XN = 2 while leaving XL = 16. 3. Set the XCLKCFG[T] bit to initiate a Turbo mode change. 4. Issue a PWRMODE command to place the core into Idle. 5. On Resume from Idle, keep running at 208 MHz Run mode. 6. At the next power management evaluation event, change the frequency to 416 MHz if required. This gets to power-saving IDLE fast and has low-latency to running code at 208 MHz 4. Use S0/D0CS/C0 run as an Idle replacement. S0/D0CS/C0 run has low power operation, but some peripherals don't run in S0/D0CS/C0 and peripheral clock dividers must be changed (LCD refresh, audio, etc.) · Resume latency is ~60 µs · This flow is the recommended flow for lowest power IDLE. This is part of the power management software provided by Marvell. 5. As a workaround, when using 806 MHz or 416 MHz Idle modes, implement a watchdog timer reset that resets the processor in the event of a system hang. 5.36 Errata (FEr#36) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-3721 MP-3721 Description: 1-WIRE: Reads bad data when Receive-Buffer-Full status bit is set. Problem: The W1INTR[RBF] flag is set when there is a byte waiting to be read in the Receive buffer. Data then read from the Receive buffer after this flag is set is bad data. The problem happens because the Rx Buffer status bit gets set too soon. Implication: Incorrect data can be received. Workaround: Wait a minimum of 2 s before reading to receive valid data. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 37 Specification Update PXA3xx (88AP3xx) Processor Family 5.37 Errata (FEr#37) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-3751 MP-3751 Description: 1-WIRE: PD flag not cleared when read (when interrupts are disabled). Problem: If interrupts are disabled and W1IER[IAS] bit is cleared, the W1NTR[PD] bit field does not get cleared. Normally, the W1INTR[PD] flag is cleared regardless of whether the interrupts are enabled or disabled. Implication: Workaround: Set the W1IER[EPD] bit and the W1IER[IAS] bits. 5.38 Errata (FEr#38) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-2628 MP-2628 Description: INTERRUPT CONTROLLER: Unexpected exception vector when ICCR[DIM]=0 and ICMR=0. Problem: When ICCR.DIM = 0 and ICMR = 0 and a direct key press is performed, the Interrupt Control IRQ Pending (ICIP) Register does not indicate a pending interrupt after coming up from idle, but the core attempts to vector to an exception-vector address (0x000 to 0x01C). Implication: If ICMR=0x0, ICCR[DIM]=0b0, and a direct key press is performed, then the correct behavior is as follows: After the key is pressed, the processor wakes from Idle, ICPR gets updated, the ICIP (or ICFP) does not get updated, and the processor should not vector to any vector address (0x00 to 0x1C). The incorrect behavior is: After the key is pressed, the processor wakes from Idle, ICPR gets updated, the ICIP (or ICFP) does not get updated, but the processor tries to vector to 0x18 (for IRQ handler) or 0x1C (for FIQ handler), based on the contents of ICLR. Keypad and DIM bit and ICMR test failure: ICCR = 0x00000000, ICMR = 0x04000000. KPC = 0x000001C3; KPC[DIE] = 1; KPC[DE] = 1; KPKDI[DIRECT KEY DEBOUNCE INTERVAL] = 20 (ms). Workaround: The code below disables interrupts to the core before going to idle and re-enables core interrupts after returning from Idle. IDLE: .global IDLE mrs r0, cpsr @ read current processor status register orr r0, r0, #0xC0 @ disable core interrupts msr cpsr_c, r0 @ update the current processor status register mov r0, #1 mcr p14, 0, r0, c7, c0, 0 @ Set IDLE mrc p14, 0, r0, c7, c0, 0 @ CPWAIT ROUTINE mov r1, r1 @ CPWAIT ROUTINE sub pc, pc, #4 @ CPWAIT ROUTINE Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 38 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family mrs bic msr mov r0, cpsr @ read current processor status register r0, r0, #0xC0 @ enable core interrupts cpsr_c, r0 @ update the current processor status register pc, r14 @ RETURN 5.39 Errata (FEr#39) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5070 MP-5070 Description: RTC: Wristwatch alarm does not interrupt at the correct time of day Problem: Wristwatch alarm does not interrupt at the preferred time of day. Implication: Workaround: The Wristwatch Alarm registers RYARx must be programmed before RDARx is set. 5.40 Errata (FEr#40) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-5015 MP-5015 Description: OST: Extra count after match when the Match Control registers are set. Problem: If both Match Control registers, OMCRx[R] and OMCRx[P], are set, the counter starts at 0x0000_0000 and increments at the frequency of the channel clock until OSCRx matches the value programmed in OSMRx. However, when this occurs in Low-power modes, one additional timer count occurs. Implication: This issue occurs in Low-power modes, when both the count frequency and the module clock frequency are 32 kHz. Once a match is detected, only in the next clock cycle is the interrupt set and counting stops. This results in one additional 32 kHz clock delay in signalling the interrupt and resetting OSCR. Workaround: Program OSMR value one less than the preferred count value, when a timer channel using 32 Kbyte clock is to be used as a wakeup source. 5.41 Errata (FEr#41) Type: Functional Errata Relevant for: PXA32x - All, PXA30x - All, PXA31x - All Fixed in: No Fix Errata BTS#: MP-4558 MP-4558 Description: DMC: Writes to uninitialized memory can hang the system. Problem: When debugging BSPs, there are times when a wrong or undefined pointer reads/writes from/to and undefined memory location. On the PXA3xx (88AP3xx) Processor Family, this occurs at an address above 0x80000000. Implication: Workaround: Initialize the memory controller before attempting to write to memory. Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 39 Specification Update PXA3xx (88AP3xx) Processor Family 5.42 Errata (FEr#42) Type: Functional Errata Relevant for: PXA32x - B1 Fixed in: PXA32x - B2 Errata BTS#: MP-6051 MP-6051 Description: DMC: DDR not always functional after S2/D3/C4 exit with Early Start (use ring oscillator) enabled, or when entering/exiting S2/D3/C4 while in S0/D0CS/C0 Problem: After a reset, including S2/D3/C4 exit, two of the internal clocks used for DDR while in S0/D0CS/C0 could become skewed. The effect is seen when entering S0/D0CS/C0 after the reset/S2/D3/C4 exit. Implication: If the clocks start up skewed after reset/S2/D3/C4 exit, DDR accesses during S0/D0CS/C0 or S2/D3/C4 exit with Early Start hang the system. Workaround: Do not use Early Start. ACCR[PCCE] must be 0. 1. Prepare the normal S2/D3/C4 wake-up sources. 2. Set the Ring Oscillator Bypass bits in the hidden OSC_TESTMODE register via writes to the hidden JCONR register. 3. Enter S2/D3/C4 mode. 4. On exit from S2/D3/C4, clear the Ring Oscillator bypass bits in the hidden OSC_TESTMODE register via writes to the hidden JCONR register. 5. Continue with normal S2 exit. The OSC_TESTMODE and JCONR registers are internal test registers. Details on the usage of these registers are not provided. Sample code for the workaround: ; This is a sample .s file with S2/D3/C4 entry and exit EXTERN SleepWAWriteRegister ; Prepare for S2/D3/C4 for workaround. ldr r0, =0x0b adr r1, dr_wrkarnd_enter bl SleepWAWriteRegister ; ; (enter S2/D3/C4 etc here) ; ; Complete S2/D3/C4 Exit for workaround. ldr r0, =0x0b adr r1, dr_wrkarnd_exit bl SleepWAWriteRegister ; ; (Rest of S2/D3/C4 exit here) ALIGN dr_wrkarnd_enter DCB "0000110000000000000000000000001", 0 ALIGN dr_wrkarnd_exit DCB "0000000000000000000000000000000", 0 Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 40 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family //This is the .h header file for the workaround #ifndef _SLEEPWA_H_INCLUDED #define _SLEEPWA_H_INCLUDED #define WORD unsigned int #ifndef NULL #define NULL 0 #endif #define #define #define #define #define SIG_ENABLE 0x80000000 SIG_TCK 0x00000040 SIG_TMS 0x00000020 SIG_TDI 0x00000010 SIG_TDO 0x00000001 extern int SleepWAWriteRegister(WORD wPortal, char *bitfield); #endif //This is the .c file for the workaround #include "SleepWrkArndWriteReg.h" WORD SleepWAWriteRBit(WORD wTDIBit, WORD wTMSBit) { volatile WORD *pMPU_Reg= (volatile WORD *)0x40F50084; if (wTDIBit = 1) wTDIBit = SIG_TDI; else if (wTDIBit = 0) wTDIBit = 0; else return (-1); if (wTMSBit = 1) wTMSBit = SIG_TMS; else if (wTMSBit = 0) wTMSBit = 0; else return (-1); *pMPU_Reg = SIG_ENABLE | wTDIBit | wTMSBit; *pMPU_Reg = SIG_ENABLE | wTDIBit | wTMSBit | SIG_TCK; Copyright © 2009 Marvell April 6, 2009 Released Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Page 41 Specification Update PXA3xx (88AP3xx) Processor Family *pMPU_Reg = 0; return (1); } int SleepWAWriteRegister(WORD wPortal, char *psBitfield) { WORD wTMSBit; int i,j; SleepWAWriteRBit(0,0); SleepWAWriteRBit(0,1); SleepWAWriteRBit(0,1); SleepWAWriteRBit(0,0); SleepWAWriteRBit(0,0); for (i=0;i> i) & 1, 0); else SleepWAWriteRBit(wPortal >> i) & 1, 1); } //On the the last data shift, the loop sets TMS to 1 // causing the TAP controller to move to the "Exit1-IR" state // move the TAP controller to the "Update-IR" state SleepWAWriteRBit(0,1); if (psBitfield = NULL) { // move the TAP controller to the "Run-Test/Idle" state SleepWAWriteRBit(0,0); return(0); } // move the TAP controller to the "Select-DR-Scan" state Doc. No. MV-S501088-00 MV-S501088-00 Rev. 2.0B Copyright © 2009 Marvell Page 42 April 6, 2009 Released Specification Update PXA3xx (88AP3xx) Processor Family SleepWAWriteRBit(0,1); // move the TAP controller to the "Capture-DR" state SleepWAWriteRBit(0,0); // move the TAP controller to the "Shift-DR" state SleepWAWriteRBit(0,0); // clock in the data // remove possible bad character from end that would mess up wTMSBit check. i = strlen(psBitfield); while ( i && (psBitfield[i]='_' || psBitfield[i]=' ') ) { psBitfield[i] = 0; i-; } for (i=0;i